Shopsy AS engages selected subprocessors to deliver Onebase. All subprocessors are bound by a Data Processing Agreement under GDPR Article 28, and transfers outside the EEA rely on SCCs or the EU–US Data Privacy Framework.
This is the public list of subprocessors. Version 2026.05.01.
Active Subprocessors
| Provider | Role | Data | Region | Transfer mechanism |
|---|---|---|---|---|
| Hetzner Online GmbH | Hosting and databases | All data stored in Onebase including account info, CRM records and attachments | EU (Falkenstein, Tyskland) | Within EEA |
| Postmark (ActiveCampaign, LLC) | Transactional email | Recipient email address, email content (OTP codes, invoices, notifications) | USA | EU–US Data Privacy Framework (Art. 45) |
| Anthropic, PBC | AI assistant (Claude API) | Chat messages, tenant name and locale, and CRM data the user queries about | USA | SCCs (Art. 46) |
| Stripe Payments Europe, Ltd. | Payments and subscription management | Tenant ID, billing address, card data (stored directly by Stripe) | Irland (EU) + USA | EU–US Data Privacy Framework (Art. 45) |
EEA-only Processing on Request
Hosting and databases already sit in the EEA, but some subprocessors (Postmark, Anthropic, Stripe Inc.) transfer data to the United States under the EU–US Data Privacy Framework or SCCs. If you require all personal data to be processed within the EEA — because of sector regulations, procurement requirements or internal policy — email [email protected]. We can offer an EEA-only configuration (no AI assistant, EEA-based email provider) for customers who need it.
Change Notifications
We notify customers at least 30 days before adding a new subprocessor or relocating an existing one.
If a customer has a reasonable objection to a new subprocessor, the contract may be terminated under the agreement. See the Data Processing Agreement for details.
Other Recipients
We do not share personal data with third parties for commercial purposes. We may disclose data to public authorities where legally required, and notify affected customers as soon as the law permits.
Questions
Email questions about the list to [email protected].